UBUNTU-CVE-2026-90155: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flcblockedrequests. The ksmbdfile reference count does not cover that graph. Both ksmbdclosefd() and the cross-request unlock path free these retained filelock objects directly. If a dependent waiter is still attached, locksreleaseprivate() hits BUGON(!listempty(&flc->flcblockedrequests)). The same lifetime mismatch can leave a freed ksmbdlock reachable through its request-local llist. Detach the filelock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locksdeleteblock() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbdlock no longer points into the submitting worker's stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Detach the file_lock from the VFS blocked-request graph before freeing it in the __ksmbd_close_fd(), cross-request unlock, and rollback paths; ensure dependent waiters are detached so locks_release_private() does not encounter non-empty flc_blocked_requests.
- Compensating control
Remove the request-local llist when a completed lock is published so a globally visible ksmbd_lock does not point into the submitting worker's stack or remain reachable after being freed.